CVE-2025-0649 HIGH

CVE-2025-0649: Stack Exhaustion In Tensorflow Serving

Vendor Google

Product Tensorflow

Weakness CWE-121

Published May 6, 2025

Last update May 6, 2025

View on NVD All CVEs

CVSS base score

8.9/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

What the vulnerability does

01Description

Incorrect JSON input stringification in Google's Tensorflow serving versions up to 2.18.0 allows for potentially unbounded recursion leading to server crash.

Key dates

02Disclosure timeline

May 6, 2025 CVE published

May 6, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-0649 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/121.html

Related vulnerabilities

04Related CVE

CVE-2023-42069 PDF-XChange Editor PDF File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability CVE-2026-5654 Stack-based Buffer Overflow in Wireshark CVE-2025-11388 Tenda AC15 setNotUpgrade stack-based overflow CVE-2024-11510 IrfanView WBZ plugin WB1 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability CVE-2026-41927 WDR201A WiFi Extender Stack-Based Buffer Overflow via firewall.cgi